Who is responsible
The controller under the GDPR is Davut Alper Caliskan, Wilhelm-Rieger-Str. 7, 90455 Nürnberg, Germany. Email: hi@shortcuta.com.
This website
The website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you open a page, your browser sends Cloudflare your IP address, the page requested, the time, and your browser’s user agent. Cloudflare uses this data to deliver the website and protect it from attacks. Request logs are kept for at most 7 days so we can find errors.
The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Cloudflare processes the data on our behalf under a data processing agreement. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which covers the transfer to the USA (Art. 45 GDPR).
Website analytics
We count visits to the website with Plausible Analytics, open-source software that we host ourselves at plausible.davutcaliskan.de. It runs on a server we rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its data center in Nuremberg, Germany. Hetzner processes the data on our behalf under a data processing agreement. Requests to the server pass through Cloudflare, as described above. Plausible sets no cookies and stores nothing on your device.
When you open a page, a script sends the page’s address, the page that linked to it, your browser, operating system and screen size, and how long you stayed and how far you scrolled. When you click a link to another website, download a file or submit a form, it records that too, but not what you typed. From your IP address it derives your country, region and city.
To count unique visitors, Plausible hashes your IP address and browser’s user agent together with the website’s domain and a random value that changes every day and is then deleted. Your IP address and user agent are not stored, and the hash can’t identify you or follow you from one day or website to the next. We only see totals, such as how many people visited a page.
The legal basis is our legitimate interest in knowing how the website is used, so we can improve it (Art. 6(1)(f) GDPR). You can object at any time by emailing us, or block the script in your browser.
Contacting us
If you email us, we use your address and message only to answer you (Art. 6(1)(b) and (f) GDPR), and delete them once your request is settled, unless we must keep them by law.
The ShortCuta app
ShortCuta runs on your computer, and you don’t need an account with us. The app sends us only what it needs to check your license, described under Your license: no usage data, no crash reports and none of your content. Your projects, videos, transcripts and settings stay on your device. Your license key, API keys and sign-ins are stored there too, encrypted by your operating system.
Speech recognition, speaker detection and face tracking run on your device. For other features, the app connects directly from your device to the service it needs, using your own account or API key. That data goes to the provider, not to us, and the provider’s privacy policy applies:
- Anthropic (Claude): transcripts, frames of your clips and your prompts, to pick clips, fix captions and draft layouts. Privacy policy
- OpenAI (Codex): the same data, for the prompts you set to a Codex model. The app runs them through Codex on your computer, signed in with your ChatGPT plan or OpenAI API key. Privacy policy
- Twitch: to list a channel’s broadcasts and download VODs. Privacy policy
- YouTube (Google): to upload your Shorts and manage them. See YouTube API Services. Privacy policy
- TikTok: to send your Shorts to your TikTok inbox as drafts, and to show which account is connected. Privacy policy
- Hugging Face: the speech models download from it once. It only receives your IP address and the download request.
- GitHub: the app looks for updates there and downloads them from it. It only receives your IP address and the requests for the update files. Privacy policy
Your license
Buying a license
You buy a license from Polar Software Inc., 3500 South DuPont Highway, Dover, DE 19901, USA, which resells ShortCuta: it takes your payment through Stripe and handles sales tax. At checkout you give Polar your name, email address, billing address and payment details, and Polar’s privacy policy applies to them.
Polar gives you your license key and shares the order with us, including your name and email address, so we can help you with your license (Art. 6(1)(b) GDPR). We keep the order until your license has ended and any questions about it are settled, unless the law requires us to keep it longer.
Checking the license
ShortCuta runs only with an active license, which it checks with our license server at api.shortcuta.com. The server runs on Cloudflare, like the website.
When you enter your key, the app sends it along with a hash of your computer’s ID, your computer’s name, your operating system and its version, and the version of ShortCuta. The hash is a one-way code made from the ID your operating system gives the computer, so the ID itself never leaves your computer. Once a day, the app sends the key, the hash and the activation’s ID again to renew the check. When you deactivate a computer, it sends the key and that activation’s ID.
The license server stores none of this. It asks Polar whether the key is valid, and Polar stores each activation with the hash, the computer’s name, the operating system and the app version, so a key runs only on the computers it’s activated on, and on no more than 3. You see your activations by computer name in Polar’s customer portal. Each one is kept until you remove it, there or in ShortCuta under Settings > License.
The server uses your IP address only to limit how many requests one address can make in a minute. When a check fails, its log notes the last six characters of the key and why it failed, so we can find errors. Cloudflare keeps these logs for at most 7 days.
The legal basis is the contract for your license (Art. 6(1)(b) GDPR) and our legitimate interest in each key running only on as many computers as it allows (Art. 6(1)(f) GDPR). Polar stores the activations on our behalf under a data processing agreement. Polar is in the USA, and the EU Standard Contractual Clauses cover the transfer there (Art. 46(2)(c) GDPR). Cloudflare is covered as described under This website.
YouTube API Services
ShortCuta uses the YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service, and the Google Privacy Policy applies.
With your permission, the app reads your channel’s name and playlists. It uploads your Shorts and sets their thumbnails, adds them to playlists, and updates or deletes the videos it uploaded. Your Google sign-in is stored only on your device. It is never sent to us or shared with anyone.
Disconnecting a channel under Settings > Connections deletes its sign-in from your device. You can also revoke ShortCuta’s access at any time in your Google account’s security settings.
Your rights
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can also object to processing based on our legitimate interests (Art. 21). To use these rights, email us at the address above.
You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR), for example the one where you live.
Changes
We update this policy when the website or the app changes. The date at the top shows when it last changed.